Loading vulnerability…
CVE-2026-64007 affects TCP timestamp adjustment in the Linux kernel's Netfilter SYNPROXY implementation. The IPv4 and IPv6 SYNPROXY hooks obtain a TCP header pointer before calling synproxy_tstamp_adjust(). That pointer can reference packet storage or a caller-local stack copy. Within synproxy_tstamp_adjust(), skb_ensure_writable() can reallocate cloned or non-linear packet storage and free the original buffer, invalidating the cached pointer. The subsequent inet_proto_csum_replace4() checksum update can therefore write into freed slab memory or update only the stack copy, leaving the transmitted packet's checksum inconsistent with its payload. The timestamp option itself is written through the current packet buffer and is unaffected by the stale pointer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed in a Red Hat Enterprise Linux 9.4 E4S kernel security update. The specific flaw and impact are not described.
A TCP-header reference handling flaw in Linux kernel Netfilter SYNPROXY. The fix refreshes tcphdr after skb_ensure_writable. A patched kernel is available through RHSA-2026:77216 and requires a reboot.
A TCP-header reference handling vulnerability in the Linux kernel Netfilter SYNPROXY component. The fix refreshes tcphdr after skb_ensure_writable. A patched kernel is available through RHSA-2026:77217 and requires a reboot.
A TCP-header pointer-refresh issue in Linux kernel Netfilter SYNPROXY processing after skb_ensure_writable(). A fix is available through RHSA-2026:77218.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.